PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Greyhound Critical Vulnerabilities - Road Rewards Program

bishopfox.com | blog | #authentication-bypass | #api-security | #responsible-disclosure | #greyhound | #pii-exposure
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Critical Greyhound API flaws from insufficient authentication exposed Road Rewards members' PII and enabled takeover of over a million accounts; the vendor left them unfixed.
Published
Collected

Related coverage

blog · bishopfox.com
A Need for Vigilance in Open Source Software: Dolibarr CRM Advisory Release
Bishop Fox explains why open source software demands vigilance, detailing three vulnerabilities found in Dolibarr CRM 9.0.1: two remote code executions and a stored XSS.
blog · bishopfox.com
Amtrak Mobile APIs - Multiple Vulnerabilities
Amtrak mobile API authentication bypass and information disclosure exposed names, addresses, trip details and partial payment data for six million guest rewards members.
blog · depthfirst.com
Our Approach to Coordinated Vulnerability Disclosure
depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
blog · yeswehack.com
‘I usually choose targets that offer value to society’: krevetk0 on his principled approach to Bug Bounty hunting
Berlin-based Bug Bounty hunter krevetk0 talks about moving from QA into hacking, choosing socially valuable targets such as healthcare and banking, and the findings that shaped his career.
blog · yeswehack.com
Why ‘HTTP/1.1 must die’, Intel exploits, C# Random hack with no maths – ethical hacker news roundup
Roundup: James Kettle's 'HTTP/1.1 must die' desync research, Eaton Zveare's Intel exploits, Doyensec's black-box C# Random account takeover, and a US court ruling's implications for disclosure.
blog · yeswehack.com
US court ruling on Uber breach slammed, red teamers cautious on AI, OffSec offers ‘strategic edge’ – OffSec roundup for CISOs
Roundup: a US court ruling on Uber's breach case raises concerns for responsible disclosure; a UK report finds red teams rarely use AI beyond basics; PwC calls offensive security a necessity.
Back